Export limit exceeded: 16509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,509

Export CSV
CVE-2022-36280

There is an out-of-bounds write vulnerability in vmwgfx driver

An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux
CVE-2026-104066

Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Scribus
Products
Scribus
CVE-2026-120067

psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Psqlodbc
CVE-2026-58458

Don't Starve Together Memory Corruption via world_gen_data

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Klei Entertainment
Products
Don't Starve Together
CVE-2026-120058

psqlODBC row cache overflow when a later FETCH changes the column count

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Psqlodbc
CVE-2026-120063

psqlODBC stack buffer overflow when quoting long schema and table names

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Postgresql
Products
Psqlodbc
CVE-2026-57198

Asterisk: Possible RED T.140 Heap Buffer Overflow

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57197

Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57194

Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-57191

Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Asterisk
Products
Asterisk Certified Asterisk
CVE-2026-118370

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-107457

Memory corruption vulnerability in QMqttClient impacts Qt MQTT

A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt Qtmqtt
CVE-2026-120452

libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Gphoto
Products
Libgphoto2
CVE-2026-20554

Modem Missing Bounds Check Enables Remote Privilege Escalation

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mediatek Mediatek, Inc.
Products
Mediatek Chipset Mediatek Chipset
CVE-2026-116741

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Xiph
Products
Speex
CVE-2026-116502

turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Turboderp-org
Products
Exllamav2
CVE-2022-1354

libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2021-3826

libiberty: Heap/stack buffer overflow in the dlang_lname function in d-demangle.c

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of service (segmentation fault and crash) via a crafted mangled symbol.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Gcc Enterprise Linux and 1 more